hxxps://ability-nosoftware-3662[.]my[.]salesforce-sites[.]com/cj

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ability-nosoftware-3662.my.salesforce-sites.com/cj

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1612308412\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1612308412\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1610706419\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1610706419\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1610706419\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1612308412\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1610706419\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1610706419\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874788163545107"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{B0E41B3B-4B3D-45E6-A848-7A34EAD669FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 5860	5824	msedge.exe	85
PID 5824 wrote to memory of 5860	5824	msedge.exe	85
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4768	5824	msedge.exe	87
PID 5824 wrote to memory of 4768	5824	msedge.exe	87
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4296	5824	msedge.exe	86
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88
PID 5824 wrote to memory of 4204	5824	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ability-nosoftware-3662.my.salesforce-sites.com/cj
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ff8aa77f208,0x7ff8aa77f214,0x7ff8aa77f220
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2028,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1952,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3544,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4816,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5124,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3484,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3820,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5564,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5564,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6052,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3620,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5868,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6852,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6860,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2796,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6324,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6800,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5524,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5428,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6200,i,9309965052035377381,1122713944428826771,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1612308412\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5824_1944691996\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
49b098d3609922b7160d3050f6e91532

SHA1
92abe78826836ecbedbe6c4b68e3483bd9daf336

SHA256
b57f70ed68920a5909508bec0ae209040327f406811aa0f9c6eb676d5bef2d9e

SHA512
229eaae862ca6abd11b6fc17af40733a7cb76ff0e65bdabb897bd604c26b3e6206dd303ea88ac3307a0a8bfe83f79056edd249d610da1c27725e6ceafcaf2af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b9773e4aa93247a6136b3df94a17704b

SHA1
b678c0c3aa20fb81bdc6fdcfc82989b29ba0fad3

SHA256
545540e97a491770d39754a6a8970b61aecbeee452bf628f91b655753a192b8f

SHA512
36e12214d5a25b3f60595414887b81c4cf8191e4faeefcdf7aaec6ade2bc86abb6f780f9483e5e0977d04c8db8d10c306cc7847171151a7874dc6f242758daf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e791.TMP

Filesize
3KB

MD5
f87a7bffce9729726cba1e3546a7fc7b

SHA1
d07e6befbbf93f6537503bc76ea0ffff73e74abc

SHA256
cb5bcc0149bdf68dab265440d24a90b5bc0048b1a8652bfdf6e61edd85d6f037

SHA512
236b61fe4c49170eea5f83919146750af09d5998dd03c7233f01d435819541b7c5b9acee1ca26eef41a4e03647aa9bb4223329abd6fe4d021dc439e0b5bf86d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
10e09da2be266bbbf52e38001f024355

SHA1
495a09321629bcca8d1d68f0a769777d5bd2a776

SHA256
a18d3f98a91af0d21226a84a45275f6178f5ee24a3e3e39ea93936ed6676a863

SHA512
11934de51796cd89307aab1d52565c799e7758423b67b34d0ad10ac5f3548ba9da4aa51165ce6667358f1c6f5754fa246e155a2fe3ffb40fa5ac1ed9dde608d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e9c16acd8071ff7812319ebfe1327790

SHA1
436619f955258f54d998f5668ac7dcdb1c744377

SHA256
14b53034fbbc425ffde4e869f9c6c8fc8435e288044f619aa9579c3f3ed9c107

SHA512
922fb670e64bf5f16bb5aa2ce7406810cd2521a9d120c814b2587d2b27048080a6f9efb34245b9fdb392b83c1ff53012c99c2c4dc2447190bb7f739927c2efba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6403647c1b777b366885981b83c8436f

SHA1
6ad9d2a61f47e8857563f70ef23891393ebb02a4

SHA256
1f2701d93ec524e0fb1df0a404bb3094a85edb825af1cca58ec72000db12bd0d

SHA512
c8393f41ae6fc93c936e5b82056e1b7567c2822a0590c2114245d673592b05f7a367b16fe907b73ce6c7d7d43199a866a0d5afc190a993ba9df8d4870ab78f39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
674d3c1a203f65cd5d9ffb727641d91b

SHA1
3cd9abedb6bd46d2e9f10896105ea802a664e787

SHA256
1be9f47f29de91c021cc899e4d984a4d2038a242b5afd5d2431f40a087ea2a75

SHA512
080d067988873547ee52a51107906598b9ed316349e5a066fef51cb2704d067886f879f9f8402e1d1b9b020a7ec4576be15419d4c6893f047f4589bafa60fab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
1d441228f06bda8a60f2dfafe5b898c4

SHA1
fe56d593f666a60b8aa26baeea522a2693ef5a02

SHA256
cec556cda56920978ec2d7a134d1c196f66a81586985bfa07d1184900f69cf6a

SHA512
47ded95ebf7c4b7f3d44d07f0974bd7f5f51c91ab8b21e550d3c9cac967d1f28e90c9a8606567c16fff2d34428ee3345d06c741d351aca8a3a09e21029f72c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
01b5368f123e98431e07e87cf4394e86

SHA1
8f799630753da30c013f66a48d3db37e9bb23e81

SHA256
f66ba68835d32f035ec481391ddd248bfaef173905270690d735c31fe2afca84

SHA512
e891f6ad179ccc7509a66d1c8e594d8bf3d440c0669058c39fc8dba972dd8ffe42503e9f64e82afab8a679e537b9edfe4690dbfad0224f1384abc1c1b0bb6371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
a7a3d98af613d2a50b6320964965ffc9

SHA1
171e074e640134287482dff0896ba54c3369037c

SHA256
6e3f9d13c90110b8d16c5b27a3b6de705788223ccee02cfa4f7f17d807784915

SHA512
a2e4f12aae9b6b329a1a5f81d084f53e7106893361c3081a12998b21ab743150ca8a6d5eabd2d4c2e2f414ee96abe2367fffacc57bd486fb91f2d2ade6eb4eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
1294f61153e5b39af2a212d865a7a576

SHA1
a47bb07061387a764c76770895136996fd316a4d

SHA256
b514307088011d0f1fcea921a6bd337fcf3f90478ad7659139f698db8f1a9c27

SHA512
b2484af16f660da0c9be928c5537e4bfcc367867896f9a7b25f8a3c18c438d329037dfdabf90df8948d77bad4073497bba35e2ff906834404f0e7754acc304b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
4747b27a047f1ed05d1ed9401b30e234

SHA1
173f3486046602b9750256527f90298f9b7d39b9

SHA256
ca6a6dcff34526a9a27ad73040a0a81179d9eeab2452153ba2792d7caefce215

SHA512
c0d5cf12318b119ae0b1236e611273a1d1abe07238527c36a15c41da4071e45854da672891caca4efbeeb49825c7df42f5d72cddb081a85c1aee49b364812e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f2b56430dea98b874e769d328da58130

SHA1
a2963af0f19dd117ae3cd8709a0b6ab2055241b5

SHA256
42168b4f1bb383a43c41b852931dcb2fb6ec3fd09f883d3d9e3b125a9758ad58

SHA512
6e813f711f61652450ea75da27ccbe7a92fd709001485027f2cbb1df249f0c539c93a7ed375e462a84366ff88398277bbd8e87b8a647dea58e428536e28e8849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
5827c16108bb2dedf67b12144ace8e8d

SHA1
3c186f62d77ec54eba58b4bb179bd732031f382f

SHA256
492fa2676f337a8d854dac0a5231d622a7a6152e27cd5d98c70a7d80d50abd73

SHA512
dc3d9b6c5ea0d7caa1b49bac0ddbf83e13c92f4ceb3963ac90f78ee83eead62da8131d6f0c89432b2bf7616ba004d4da91b7283816c30477c3d6ddd62fac4d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
1d889cad8edbfdb2b88843cc16daac88

SHA1
0e3dc1955eaeb773c790a13c2dcbea8ae1dd068a

SHA256
fab24892bfb8ca8d5af39ea9130e3100cde9c7e63d1cc99baf56190053d867c1

SHA512
552e3cb293a569c94422c188b8c11c44bd7edffede29b02a44744195550325a15107b57b4beaf574c8df657a57af9ec73d2efdfc9c3337e32d743c0c1b7cb876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
172ac39232e263f445bf88e31d1cc842

SHA1
c8947bdfae90af138741c7a40b8093e77313bff4

SHA256
9602543d0ab17956c88f81d831bd8fb332b7c6b6588855c04268fa03efecf8c9

SHA512
f0720e76e40d2c43b60025ec0d8f28890a8dc3622b7535868c9b64ef527982b5199c88e1f2e27a979559c50b311c0b673f8451b1065f8a7627dbbc325e34b20d

Download Submit